WO2023202321A1 - Procédé, système et dispositif de gestion de données - Google Patents

Procédé, système et dispositif de gestion de données Download PDF

Info

Publication number
WO2023202321A1
WO2023202321A1 PCT/CN2023/083514 CN2023083514W WO2023202321A1 WO 2023202321 A1 WO2023202321 A1 WO 2023202321A1 CN 2023083514 W CN2023083514 W CN 2023083514W WO 2023202321 A1 WO2023202321 A1 WO 2023202321A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
client
distributed ledger
access
update
Prior art date
Application number
PCT/CN2023/083514
Other languages
English (en)
Chinese (zh)
Inventor
赵明宇
严学强
李波
习燕
汪洋
邢玮俊
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023202321A1 publication Critical patent/WO2023202321A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security

Definitions

  • the present application relates to the field of communication technology, and in particular, to a data management method, system and device.
  • User data management is one of the core functions of mobile communication networks.
  • the provision of user services and the normal operation of the network require user data management entities and related processes.
  • the user data management entity of the mobile network stores user and service subscription-related data, key information, etc., and is the key to realizing user authentication, authorization, and access control.
  • distributed ledgers have the characteristics of tamper-proof, decentralization, and multi-party participation, they can effectively reduce the trust cost caused by centralized structures. People usually choose distributed ledger platforms as user data management entities. For example, the client needs to verify permissions through the distributed ledger platform before accessing data.
  • the access interface for permission verification Since the access interface for permission verification is opened, a large number of clients need to access the distributed ledger platform to verify whether they have access permissions before accessing data. Since a large number of clients need to access data multiple times and repeatedly, the access interface for permission verification of the distributed ledger platform will receive a large number of data access permission verification requests. Based on this method, the distributed ledger platform is prone to network attacks. , reducing the security of data access by clients. Therefore, how to improve the security of data accessed by clients is an urgent problem that needs to be solved.
  • the embodiments of the present application provide a data management method, system and device, which is beneficial to improving the security of data access by clients.
  • embodiments of this application propose a data management system, which includes a client, a data storage entity and a distributed ledger node, where:
  • the client is used to send a data access request to the data storage entity.
  • the data access request carries the identity of the client and/or the identity of the user who logs in to the client;
  • This data storage entity is used to generate an access permission verification request based on the data access request after receiving the data access request from the client, and send the access permission verification request to the distributed ledger node.
  • the access permission verification request is used to verify the client. Whether it has the permission to access the data, the access permission verification request carries the identity of the client and/or the identity of the user who logs in to the client;
  • the distributed ledger node is used to verify whether the client has data access permissions based on the client's identity and/or the identity of the user logging in to the client and the distributed ledger after receiving an access permission verification request sent from the data storage entity.
  • the distributed ledger stores the data access policies of clients and/or users;
  • the distributed ledger node is also used to send a first access permission verification response to the data storage entity if the client has data access permission, and the first access permission verification response is used to indicate that the client has data access permission;
  • the data storage entity is also used to send corresponding data to the client after receiving the first access permission verification response sent from the distributed ledger node.
  • the client when the client requests data access, it does not need to verify whether it has access rights through the distributed ledger platform. Instead, it sends a data access request to the data storage entity, and the data storage entity requests distributed ledger verification. Whether the client has access rights. During the data access process, the client cannot directly interact with the distributed ledger platform through the interface. Therefore, the distributed ledger platform can be prevented from being attacked by the network, which is beneficial to improving the security of the client's data access.
  • the data storage entity is also used to send a data return success message to the distributed ledger node, and the data return success message carries the client's data access transaction information; the distributed ledger node is also used to After receiving the data return success message sent by the data storage entity, the client's data access transaction information is recorded in the distributed ledger.
  • the distributed ledger platform can store the transaction information of data access by each client through the distributed ledger, which will help the subsequent distributed ledger platform to better manage data.
  • the data storage entity when the data storage entity generates an access permission verification request based on a data access request, it is specifically used to generate an access permission verification request based on a smart contract and a data access request; the distributed ledger node generates an access permission verification request based on the data access request; When the entity sends the first access permission verification response, it is specifically used to generate the first access permission verification response based on the smart contract and send the first access permission verification response to the data storage entity. Based on this implementation method, the security of data access by the client can be improved.
  • the distributed ledger node is also used to send a second access permission verification response to the data storage entity if the client does not have data access permission, and the second access permission verification response is used to instruct the client The client does not have data access rights.
  • the client is also used to send a data update request to the data storage entity, and the data update request carries the identity of the client and/or the identity of the user who logs in to the client; the data storage entity is also used to After receiving the data update request sent from the client, an update permission verification request is generated based on the data update request, and an update permission verification request is sent to the distributed ledger node.
  • the update permission verification request is used to verify whether the client has the permission to update the data.
  • the update authority verification request carries the client's identity and/or the identity of the user who logs in to the client; the distributed ledger node is also used to, after receiving the update authority verification request sent from the data storage entity, based on the client's identity and/or login.
  • the client's user identification and the distributed ledger verify whether the client has the permission to update data.
  • the distributed ledger stores the data update policy of the client and/or the user; the distributed ledger node is also used if the client has data update permissions.
  • permission the first update permission verification response is sent to the data storage entity.
  • the first update permission verification response is used to indicate that the client has data update permission; the data storage entity is also used to receive the first update permission verification response sent from the distributed ledger node.
  • update the corresponding data of the client update the corresponding data of the client.
  • the client can flexibly update the data in the data storage entity. During the data update process, the client cannot directly interact with the distributed ledger platform through the interface. Therefore, it can avoid the distributed ledger platform from being damaged by the network. Attack situation, thus helping to improve the security of data updates by the client.
  • the embodiment of the present application proposes a data management method.
  • the method includes: the data storage entity receives a data access request sent from the client; the data storage entity generates an access permission verification request based on the data access request and sends it to the distribution
  • the ledger node sends an access permission verification request.
  • the access permission verification request is used to verify whether the client It has the authority to access data, and the access authority verification request carries the identity of the client and/or the identity of the user who logs in to the client; the data storage entity receives the first access authority verification response sent from the distributed ledger node, and the first access authority verification response is To indicate that the client has data access rights; the data storage entity sends corresponding data to the client.
  • the beneficial effects of the second aspect may refer to the content described in the first aspect.
  • the data storage entity sends a data return success message to the distributed ledger node, and the data return success message carries the client's data access transaction information.
  • the specific implementation method is: the data storage entity generates an access rights verification request based on the smart contract and the data access request.
  • the method also includes: the data storage entity receives the data update request sent from the client, the data storage entity generates an update permission verification request based on the data update request, and sends the update permission verification to the distributed ledger node.
  • the update permission verification request is used to verify whether the client has the permission to update data.
  • the update permission verification request carries the identity of the client and/or the identity of the user who logs in to the client; the data storage entity receives the first update sent from the distributed ledger node Permission verification response, the first update authority verification response is used to indicate that the client has data update permission; the data storage entity updates the data corresponding to the client.
  • the embodiment of this application proposes a data management method.
  • the method includes: when the distributed ledger node receives an access permission verification request sent from the data storage entity, the access permission verification request is used to verify whether the client has Permission to access data, the access permission verification request carries the identity of the client and/or the identity of the user who logs in to the client; the distributed ledger node verifies whether the client has data based on the identity of the client and/or the identity of the user who logs in to the client and the distributed ledger Access permissions, the distributed ledger stores the data access policy of the client and/or user; if the client has data access permissions, the distributed ledger node sends a first access permission verification response to the data storage entity, the first access permission verification The response is used to indicate that the client has access to the data.
  • the distributed ledger node After the distributed ledger node receives the data return success message sent by the data storage entity, the data return success message carries the client's data access transaction information; the distributed ledger node records the client's data access transaction information into the distribution in the ledger.
  • the distributed ledger node if the client has data access rights, the distributed ledger node sends a first access rights verification response to the data storage entity.
  • the specific implementation method is: if the client has data access rights, then the distributed ledger node sends a first access rights verification response to the data storage entity.
  • the distributed ledger node generates the first access permission verification response based on the smart contract; the distributed ledger node sends the first access permission verification response to the data storage entity.
  • the method further includes: if the client does not have data access permission, the distributed ledger node sends a second access permission verification response to the data storage entity, and the second access permission verification response is used to instruct the client The client does not have data access rights.
  • the method also includes: the distributed ledger node receives an update permission verification request sent from the data storage entity, the update permission verification request is used to verify whether the client has the permission to update the data, and the update permission verification request carries The identity of the client and/or the identity of the user who logs in to the client; the distributed ledger node verifies whether the client has the authority to update data based on the identity of the client and/or the identity of the user who logs in to the client and the distributed ledger, and the distributed ledger stores the client Data update policy of the client and/or user; if the client has data update permission, then the first update permission verification response is sent to the data storage entity, and the first update permission verification response is used to indicate that the client has data update permission.
  • this application provides a communication device, which may be a data storage entity or a data storage entity.
  • the communication device may also be a chip system.
  • the communication device can perform the method described in the second aspect.
  • the functions of the communication device can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the unit or module may be software and/or hardware.
  • this application provides a communication device, which may be a distributed ledger node, a device in a distributed ledger node, or a device that can be used in conjunction with a distributed ledger node.
  • the communication device may also be a chip system.
  • the communication device can perform the method described in the third aspect.
  • the functions of the communication device can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the unit or module may be software and/or hardware.
  • the operations and beneficial effects performed by the communication device can be referred to the method and beneficial effects described in the third aspect above, and repeated details will not be repeated.
  • the present application provides a communication device.
  • the communication device includes a processor.
  • the processor calls a computer program in a memory, the method in any one of the second aspect or the third aspect is executed. .
  • the present application provides a communication device.
  • the communication device includes a processor and an interface circuit.
  • the interface circuit is used to receive signals from other communication devices other than the communication device and transmit them to the processor or to transmit signals from the processor.
  • the signal is sent to other communication devices other than the communication device, and the processor is used to implement the method of any one of the second aspect or the third aspect through logic circuits or executing code instructions.
  • the present application provides a computer-readable storage medium.
  • Computer programs or instructions are stored in the storage medium.
  • the computer program or instructions are executed by a communication device, any one of the second or third aspects is implemented. Methods.
  • the present application provides a computer program product including instructions, which when a computer reads and executes the computer program product, causes the computer to perform the method of any one of the second aspect or the third aspect.
  • Figure 1 shows a possible 5G user data management architecture
  • Figure 2 shows a possible data management system based on a distributed ledger platform
  • Figure 3 is a schematic diagram of a data management system provided by an embodiment of the present application.
  • Figure 4 is a schematic flow chart of a data management method provided by an embodiment of the present application.
  • Figure 5 is a user data storage format provided by an embodiment of the present application.
  • Figure 6 is a schematic flow chart of another data management method provided by an embodiment of the present application.
  • Figure 7 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 8 is a schematic structural diagram of yet another communication device provided by an embodiment of the present application.
  • Figure 9 is a schematic structural diagram of a chip provided by an embodiment of the present application.
  • an embodiment means that a particular feature, structure or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application.
  • the appearances of this phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Those skilled in the art understand, both explicitly and implicitly, that the embodiments described herein may be combined with other embodiments.
  • At least one (item) means one or more
  • plural means two or more
  • at least two (items) means two or three and three
  • “and/or” is used to describe the corresponding relationship between associated objects, indicating that there can be three relationships.
  • a and/or B can mean: only A exists, only B exists, and A and B exist simultaneously. In this case, A and B can be singular or plural.
  • the character “/” generally indicates that the related objects are in an "or” relationship.
  • At least one of the following” or similar expressions thereof refers to any combination of these items, including any combination of a single item (items) or a plurality of items (items).
  • At least one of a, b or c can mean: a, b, c, "a and b", “a and c", “b and c", or "a and b and c” ”, where a, b, c can be single or multiple.
  • User data management is one of the core functions of mobile communication networks.
  • the provision of user services and the normal operation of the network rely on user data management entities and related processes.
  • User data management entities are the key to realizing user authentication, authorization and access control, so ensuring The security of user data management entities is also the key to ensuring the security of user data.
  • Figure 1 shows a possible 5G user data management architecture.
  • the data management architecture includes unified data management (Unified Data Management, UDM), unified data warehouse function (Unified Data Repository, UDR), access And mobility management function (access and mobility management function, AMF), session management function (Session Management Function, SMF), authentication service function (Authentication Server Function, AUSF), short message service function (Short Message Service Function, SMSF), network Open function (Network Exposure Function, NEF) and policy control function (Policy Control function, NEF).
  • UDM Unified Data Management
  • UDR Unified Data Repository
  • AMF access And mobility management function
  • Session Management Function SMF
  • authentication service function Authentication Server Function, AUSF
  • SMSF Short Message Service Function
  • NEF Network Exposure Function
  • Policy Control function Policy Control function
  • the user data management entities are UDM and UDR.
  • UDM is mainly responsible for the management of user identification, contract data, authentication data, and user service network element registration management;
  • UDR is mainly responsible for storing user data, such as customer profile information, customer identity verification information, and information encryption keys.
  • UDM comes in both stateful and stateless versions. Stateful UDM stores data locally, while stateless UDM stores data outside the UDR.
  • UDM manages access authorization, user registration and other data. Both UDM and UDR can send and store data.
  • user information is stored in UDR and UDM is used to retrieve the data and send it to other network functions.
  • AMF is mainly responsible for terminal equipment accessing the network, authenticating the terminal equipment identity, enabling terminal equipment to move around and maintaining network connections; SMF is mainly responsible for allocating Internet access to terminal equipment.
  • IP Internet Protocol
  • the AUSF is mainly responsible for the AMF's request for authentication of the terminal device, by requesting the UDM Request the key, and then forward the key issued by UDM to AMF for authentication processing
  • SMSF is mainly responsible for providing registration, deregistration, and sending and receiving Network Attached Storage (NAS) SMS services to 5G end users
  • NEF is mainly responsible for connecting the network Capabilities are open to third-party applications to achieve a friendly connection between network capabilities and business needs, improve business experience, and optimize network resource allocation
  • PCF can support a unified policy framework to manage network behavior, provide policy rules for network entities to implement, and has access to UDR subscription information.
  • UDM and UDR are mainly responsible for data storage and policy management.
  • UDM and UDR's centralized data storage and centralized authentication and authorization have the potential for single points of failure and network attacks. sex.
  • users have no control over their personal data.
  • Personal user data is stored centrally in the database of the network provider/service provider.
  • the network provider/service provider can share user data with third parties without the user’s knowledge, resulting in huge privacy. Leakage risks.
  • Distributed ledger Technology is a database that is shared, replicated and synchronized among network members.
  • Distributed ledgers record transactions between network participants, such as the exchange of assets or data.
  • Distributed ledgers have the characteristics of tamper-proof, decentralization, multi-party participation, etc., which can effectively reduce the trust cost caused by centralized structures.
  • People usually choose distributed ledger platforms as user data management entities. Please refer to Figure 2.
  • Figure 2 shows a possible data management system based on a distributed ledger platform, which includes a client, a distributed ledger node and a data storage entity.
  • the client is a data requesting entity and has the function of requesting data access
  • the distributed ledger node is a node device used by the distributed ledger platform for external data transmission.
  • the distributed ledger platform corresponding to the distributed ledger node has the ability to implement data access.
  • the distributed ledger proposed in the embodiment of this application can be a blockchain, and the distributed ledger node can be a blockchain node.
  • the data management system based on this distributed ledger platform can implement the data access method shown in steps 201 to 206:
  • the client sends an access permission request to the distributed ledger node.
  • the distributed ledger node receives the access permission request sent from the client, where the access permission request carries the user ID. Based on the user ID, the distributed ledger node determines that the client has data access permissions and generates Proof of license.
  • the distributed ledger node sends an access permission response to the client.
  • the client receives the access permission response sent from the distributed ledger node, where the access permission response carries the permission certificate.
  • the client sends a data access request to the data storage entity.
  • the data storage entity receives the data access request sent from the client, where the data access request carries the permission certificate.
  • the data storage entity sends an access permission verification request to the distributed ledger node.
  • the distributed ledger node receives the access permission verification request sent from the data storage entity, where the access permission verification request carries the permission certificate.
  • the distributed ledger node verifies the authenticity and validity of the license certificate, it will generate an access rights verification result indicating that the license certificate is authentic and valid.
  • the distributed ledger node sends the access permission verification result to the data storage entity.
  • the data storage entity receives the access permission verification result sent from the distributed ledger node.
  • the data storage entity sends a data access response to the client.
  • the client receives a data access response sent from the data storage entity, and the data access response carries the data requested by the client.
  • the data management system may include at least one client, at least one distributed ledger node, and at least one data storage entity.
  • the data management system illustrated in Figure 3 includes a client, a distributed ledger node, and a data storage entity.
  • the application embodiment does not limit the number of clients, distributed ledger nodes and data storage entities.
  • the client is a network functional entity connected to the data storage entity in the data management system, including but not limited to: data subject (Data Subject, DS), data control entity (Data Controller, DC) and data processing entity (Data Processor). ,DP).
  • the distributed ledger node is a node device used by the distributed ledger platform for external data transmission.
  • the distributed ledger platform corresponding to the distributed ledger node has the functions of realizing authentication, authentication, authorization and access control logic for data access. This distribution
  • the ledger platform stores a distributed ledger that cannot be tampered with and is used to record the client’s data access records and policy management records for auditing. Data storage entities are used to store individual user data.
  • the client can be a mobile phone (mobile phone), a personal computer (PC), a wireless terminal in industrial control (industrial control), a vehicle-mounted terminal device, a wireless terminal in self-driving (self-driving), or a smart grid Wireless terminals, wearable terminal devices, etc. in (smart grid).
  • the embodiments of this application do not limit application scenarios.
  • the terminal can sometimes also be called terminal equipment, user equipment (UE), access terminal equipment, vehicle terminal, industrial control terminal, UE unit, UE station, mobile station, mobile station, remote station, remote terminal equipment, mobile Equipment, UE terminal equipment, terminal equipment, wireless communication equipment, UE agent or UE device, etc.
  • the client can also be a server.
  • it can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or it can provide cloud services, cloud databases, cloud computing, cloud Cloud servers for basic cloud computing services such as functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.
  • cloud services such as functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.
  • CDN Content Delivery Network
  • the distributed ledger node or data storage entity can be a server. Specifically, it can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also provide cloud services, cloud databases, and cloud computing. , cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and cloud servers for basic cloud computing services such as big data and artificial intelligence platforms.
  • the data management system contains three interfaces, namely interface A, interface B and interface C.
  • interface A is the interface between the client and the distributed ledger node.
  • the client when the client performs data access, the client does not need to directly access the distributed ledger node. Obtain the permission certificate, but directly send the data access request to the data storage entity, and the data storage entity requests the distributed ledger This node verifies the client, and the client does not directly interact with the distributed ledger node through interface A.
  • Interface A is mainly used to implement data interaction between the client and the distributed ledger node when conducting user registration, user logout or policy management transactions.
  • Interface B is the interface between the data storage entity and the distributed ledger node. The data storage entity requests the distributed ledger node to verify and authorize the client through interface B.
  • Interface C is the interface between the client and the data storage entity. Interface C is mainly used to implement data access requests and responses.
  • the client does not directly interact with the distributed ledger platform through interface A, which avoids the distributed ledger node from receiving access permission requests from a large number of clients. situation, thus avoiding network attacks on the distributed ledger platform.
  • the number of data storage entities is significantly reduced compared to clients, and the security is higher. Through this system, the security of data access by clients can be improved.
  • the data management method includes steps 401 to 407.
  • the method execution subjects shown in Figure 4 can be clients, distributed ledger nodes and data storage entities.
  • the method execution subject shown in Figure 4 can be a chip in the client, a chip in the distributed ledger node, and a chip in the data storage entity.
  • Figure 4 takes the client, distributed ledger node and data storage entity as an example to illustrate. The execution subject of subsequent flow charts is the same and will not be described again. in:
  • the client sends a data access request to the data storage entity.
  • the data storage entity receives the data access request sent from the client.
  • the data access request is used to instruct the client to request data access.
  • the data access request carries the client's identity and/or the user's identity, so that the data storage entity distributes data to the client based on the client's identity and/or the user's identity.
  • the ledger node initiates an access permission verification request to verify whether the client has data access permissions.
  • the data access request may also carry the client's private key signature and/or the client's data access policy.
  • the information carried in the data access request is mainly used by the distributed ledger node to confirm the client's identity and data access policy. Based on the client's data access policy, it instructs the data storage entity to return the data corresponding to the client or reject the data access request.
  • the user ID may be the ID of the user who logs in to the client, or it may be the ID of the user who logs in to the target device.
  • the target device authorizes the client to access personal data, so the client can log in to the target device by carrying the ID of the user.
  • the user's identification access the data corresponding to the user. It should be added that if the client needs to access the data of the target device, the data access request must not only carry the identification of the user of the target device, but also the corresponding digital signature of the user of the target device to ensure that the data security.
  • the client does not need to verify whether it has access rights through the distributed ledger platform. Instead, it sends a data access request to the data storage entity, and the data storage entity requests the distributed ledger to verify whether the client has access rights.
  • the client directly interacts with the distributed ledger platform without using the interface. Therefore, it reduces the situation where the distributed ledger node receives request information from a large number of clients, thereby reducing the number of requests sent by the distributed ledger platform.
  • the possibility of network attacks will help improve the security of data access by clients.
  • the data storage entity generates an access permission verification request based on the data access request.
  • the access rights verification request is used to verify whether the client has data access rights.
  • the access rights verification request carries the client's identity and/or the user's identity.
  • the data access request also carries the client's identity private key signature and/or the client's data access policy
  • the data access request also carries the client's private key signature and/or or the client's data access policy.
  • the data storage entity generates an access permission verification request based on the data access request.
  • the specific implementation method is: the data storage entity generates an access permission verification request based on the smart contract and the data access request.
  • a smart contract is a computer protocol designed to disseminate, verify or execute contracts in an information-based manner.
  • the rules proposed by smart contracts are open and transparent, and the rules and data within the contract are visible to the outside world. Smart contracts allow trusted transactions to be made without third parties, which are traceable and irreversible. Since smart contracts are traceable and irreversible, based on this implementation, the security of data interactions between data storage entities and distributed ledger nodes can be improved.
  • the data storage entity sends an access permission verification request to the distributed ledger node.
  • the distributed ledger node receives the access permission verification request sent from the data storage entity.
  • the distributed ledger node when the distributed ledger node receives a message requesting verification permission from other devices (clients or data storage entities), it will first determine what kind of transaction it is based on the message, and then, based on The user ID or device ID carried in the message determines the control policy of the user or device in the distributed ledger, thereby determining whether the user or device has the corresponding authority for the transaction. Based on the method described in this application, the distributed ledger node receives the access permission verification request sent from the data storage entity. The access permission verification request is generated based on the data access request sent by the client. Therefore, the access permission verification request The corresponding transaction type is data request. In addition to data requests, the types of transactions that distributed ledger nodes can handle include: user registration, user logout, data updates, policy management, etc.
  • the transaction information is stored in the distributed ledger node, and the distributed ledger node determines the transaction type based on the transaction information and messages sent by other devices from the outside world.
  • the storage format of transaction information is shown in Figure 5.
  • Transaction information is stored in the distributed ledger in the form of blocks, and the user's personal data is stored off-chain in the form of a hash function.
  • the transaction information also includes identification, transaction type, User data pointer, data access policy and digital signature.
  • the user data pointer indicates the storage address of the user's personal data, and the digital signature is used to implement authentication and ensure data security.
  • user registration means that the client will provide personal information to request the distributed ledger platform to register a user.
  • the client's user data and access control policies will be stored in the data storage entity.
  • User logout means that the client initiates a request to the distributed ledger node to log out personal information, and the distributed ledger node sends a message instructing the data storage entity to delete the client's user data and access control policy.
  • Policy management means that the client maintains its data access policy through the customer-oriented management interface provided by the service provider.
  • Data update refers to the client's request to update user data stored in the data storage entity.
  • the interfaces required for user registration include interface A and interface B.
  • the specific processing method is: the client sends a registration request carrying user information to the distributed ledger node through interface A; after receiving the registration request, the distributed ledger node passes the interface B sends a registration instruction message to the data storage entity; the registration instruction message carries the user information and the access control policy corresponding to the user, and the data storage entity stores the user information and the access control policy corresponding to the user.
  • the interfaces required for user logout include interface A and interface B.
  • the specific processing method is: the client sends a logout request carrying user information to the distributed ledger node through interface A; after receiving the logout request, the distributed ledger node passes the interface B sends a logout instruction message to the data storage entity, which carries the user information; after receiving the logout instruction message, the data storage entity deletes the data information corresponding to the user and the access control policy corresponding to the user. slightly.
  • the interfaces required for policy management include interface A.
  • the specific processing method is: the client sends a policy management request carrying user information to the distributed ledger node through interface A.
  • the policy management request indicates to adjust the control policy corresponding to the user; after receiving After receiving the policy management request, the distributed ledger node adjusts or maintains the control policy corresponding to the user based on policy management.
  • the interfaces required for data update include interface B and interface C.
  • interface B For the processing flow corresponding to data update, please refer to the description in Figure 6, which will not be described in detail here in the embodiment of the present application.
  • the distributed ledger node verifies whether the client has data access permission based on the client's identity and/or the user's identity and the distributed ledger.
  • the distributed ledger stores the data access policy of the client and/or the user.
  • the distributed ledger node can verify the information carried in the request based on the access permissions and correspond one-to-one with the information stored in the distributed ledger. , if the client's identity and/or the user's identity are exactly the same as the information in the distributed ledger, and the data access policy determines that the client has data access rights, then it is confirmed that the client has data access rights. If the client's identity and/or user's identity are different from the information in the distributed ledger, or the data access policy determines that the client does not have data access rights, then it is confirmed that the client does not have data access rights.
  • the distributed ledger cannot be tampered with. Since the distributed ledger stores the data access policies of clients and/or users, if the distributed ledger can tamper with the data access policies, it will be easy for some clients to maliciously tamper with personal data access policies, modify their own permissions, and affect the data. security. Therefore, the distributed ledger cannot be tampered with, which helps improve the security of users’ personal data.
  • the distributed ledger also stores data access records of clients and/or users.
  • the data access records include the data access transaction information of each time the client performs data access, as well as the client’s data access records. and/or the user’s data storage address. Data access records are stored in this distributed ledger, which can help improve the security of users' data access.
  • the distributed ledger node If the client has data access permission, the distributed ledger node generates a first access permission verification response, and the first access permission verification response is used to indicate that the client has data access permission.
  • the distributed ledger node generates a first access permission verification response.
  • the specific implementation method is: the distributed ledger node generates a first access permission verification response based on the smart contract, and sends the first access permission verification response to the data storage entity. Permission verification response. Since smart contracts are traceable and irreversible, based on this implementation, the security of data interactions between data storage entities and distributed ledger nodes can be improved.
  • the distributed ledger node sends the first access permission verification response to the data storage entity.
  • the data storage entity receives the first access permission verification response sent from the distributed ledger node.
  • the distributed ledger node if the client does not have data access rights, the distributed ledger node generates a second access rights verification response, and the second access rights verification response is used to indicate that the client does not have data access rights.
  • the distributed ledger node receives the second authority verification response, it will not send the corresponding data to the client.
  • corresponding punishment processing can be performed on the client, for example, any message sent by the client will no longer be processed (or no longer processed within a preset time period). Based on this implementation method, it is conducive to improving the security of user data.
  • the data storage entity sends the client's corresponding data to the client.
  • the method also includes: the data storage entity sends a data return success message to the distributed ledger node, and the data return success message carries the client's data access transaction information; the distributed ledger node, After receiving the data return success message sent by the data storage entity, the client's data access transaction information is recorded in the distributed ledger.
  • the distributed ledger cannot be tampered with.
  • the distributed ledger of the distributed ledger platform stores information about data access by each client, which is beneficial to the security of data access by clients.
  • the client directly interacts with the distributed ledger platform without using the interface. Therefore, it reduces the situation where the distributed ledger node receives permission verification requests from a large number of clients. , thereby reducing the possibility of network attacks on the distributed ledger platform, and helping to improve the security of data access by clients.
  • Figure 6 is another data management method provided by an embodiment of the present application. It is mainly used to describe client update data.
  • the data management method includes steps 601 to 607.
  • Figure 6 illustrates using the client, distributed ledger node and data storage entity as the execution subjects. in:
  • the client sends a data update request to the data storage entity.
  • the data storage entity receives the data update request sent from the client.
  • the data update request is used to instruct the client to request data update.
  • the data update request carries the client's identity and/or the user's identity, so that the data storage entity distributes data to the client based on the client's identity and/or the user's identity.
  • the ledger node initiates an update permission verification request to verify whether the client has data update permission.
  • the data update request may also carry the client's private key signature and/or the client's data update policy.
  • the information carried in the data update request is mainly used by the distributed ledger node to confirm the client's identity and data update policy. Based on the client's data update policy, it instructs the data storage entity to update the data corresponding to the client or reject the data access request.
  • the user ID is the same as the user ID described in step 401 of the above figure.
  • the user ID can be the ID of the user who logs in to the client, or it can also be the ID of the user who logs in to the target device.
  • the target device is authorized to allow the client to update. Personal data, so the client can update the user's corresponding data by carrying the identification of the user who logged in to the target device. It should be added that if the client needs to update the data of the target device, the data update request must not only carry the identification of the user of the target device, but also the corresponding digital signature of the user of the target device to ensure that the data security.
  • the client does not need to verify whether it has update permissions through the distributed ledger platform. Instead, it sends a data update request to the data storage entity, and the data storage entity requests the distributed ledger to verify whether the client has update permissions.
  • the client does not directly interact with the distributed ledger platform through the interface. Therefore, it reduces the situation where the distributed ledger node receives requests from a large number of clients to verify permissions, thereby reducing the possibility of network attacks on the distributed ledger platform. It is helpful to improve the security of data updates on the client side.
  • the data storage entity generates an update permission verification request based on the data update request.
  • the distributed ledger node when the distributed ledger node receives a message requesting verification permission from other devices (clients or data storage entities), it will first determine what kind of transaction it is based on the message, and then, based on The news The user ID or device ID carried in the information is used to determine the control policy of the user or device in the distributed ledger, thereby determining whether the user or device has the corresponding authority for the transaction. Based on the method described in this application, the distributed ledger node receives an update permission verification request sent from the data storage entity. The update permission verification request is generated based on the data update request sent by the client. Therefore, the update permission verification request The corresponding transaction type is data request.
  • the data update request also carries the client's private key signature and/or the client's data update policy
  • the data update request also carries the client's private key signature and/or the client's data update policy.
  • the data storage entity generates an update permission verification request based on the data update request.
  • the specific implementation method is: the data storage entity generates an update permission verification request based on the smart contract and the data update request.
  • the data storage entity sends an update permission verification request to the distributed ledger node.
  • the distributed ledger node receives the update permission verification request sent from the data storage entity.
  • the distributed ledger node after receiving the update permission verification request from the data storage entity, the distributed ledger node will verify the transaction type corresponding to the update permission verification request, because the update permission verification request is based on the data update sent by the client. Generated by request, therefore, the transaction type corresponding to this update permission verification request is data update.
  • the transaction types supported by this application are the same as those described in step 403 above, and will not be described again in the embodiment of this application.
  • the distributed ledger node verifies whether the client has the authority to update data based on the client's identity and/or the user's identity and the distributed ledger.
  • the distributed ledger stores the data update strategy of the client and/or the user.
  • the distributed ledger node can verify the information carried in the request based on the update authority and correspond one-to-one with the information stored in the distributed ledger. , if the client's identity and/or the user's identity are exactly the same as the information in the distributed ledger, and the data update policy determines that the client has data update permissions, then it is determined that the client has data update permissions. If the client's identity and/or the user's identity are different from the information in the distributed ledger, or the data update policy determines that the client does not have data update permissions, it is confirmed that the client does not have data update permissions.
  • the distributed ledger cannot be tampered with. Since the distributed ledger stores the data update strategies of clients and/or users, if the distributed ledger can tamper with the data update strategies, it will be easy for some clients to maliciously tamper with personal data update strategies, modify their own permissions, and affect the data. security. Therefore, the non-tamperability of distributed ledgers will help improve the security of users’ personal data.
  • the distributed ledger node If the client has data update permission, the distributed ledger node generates a first update permission verification response, and the first update permission verification response is used to indicate that the client has data update permission.
  • the distributed ledger node generates a first update authority verification response.
  • the specific implementation method is: the distributed ledger node generates a first update authority verification response based on the smart contract, and sends the first update to the data storage entity. Permission verification response. Since smart contracts are traceable and irreversible, based on this implementation, the security of data interactions between data storage entities and distributed ledger nodes can be improved.
  • the distributed ledger node sends the first update authority verification response to the data storage entity.
  • the data storage entity receives the first update authority verification response sent from the distributed ledger node.
  • the distributed ledger node if the client does not have the data update authority, the distributed ledger node generates a second update authority verification response, and the second update authority verification response is used to indicate that the client does not have the data update authority. Due After the distributed ledger node receives the second authority verification response, it will not send the corresponding data to the client.
  • corresponding punishment processing can be performed on the client, for example, any message sent by the client will no longer be processed (or no longer processed within a preset time period). Based on this implementation method, it is conducive to improving the security of user data.
  • the data storage entity updates the data corresponding to the client.
  • the method also includes: the data storage entity sends a data return success message to the distributed ledger node, and the data return success message carries the client's data update transaction information; the distributed ledger node, After receiving the data return success message sent by the data storage entity, the client's data update transaction information is recorded in the distributed ledger.
  • the distributed ledger cannot be tampered with.
  • the distributed ledger of the distributed ledger platform stores information about data updates by each client, which is beneficial to the security of data updates by clients.
  • the client directly interacts with the distributed ledger platform without using the interface. Therefore, it reduces the situation where the distributed ledger node receives permission verification requests from a large number of clients. , thereby reducing the possibility of network attacks on the distributed ledger platform, and helping to improve the security of data updates by clients.
  • FIG. 7 shows a schematic structural diagram of a communication device according to an embodiment of the present application.
  • the communication device shown in FIG. 7 may include a communication unit 701 and a processing unit 702. Among them, the processing unit 702 is used for data processing.
  • the communication unit 701 integrates a receiving unit and a sending unit.
  • the communication unit 701 may also be called a transceiver unit.
  • the communication unit 701 may also be split into a receiving unit and a sending unit. Below, a detailed introduction to these two units is provided:
  • the communication unit 701 is used to receive the data access request sent from the client; the processing unit 702 is used to generate the access rights verification request based on the data access request; the communication unit 701 is also used to send the access rights verification request to the distributed ledger node,
  • the access permission verification request is used to verify whether the client has the permission to access data.
  • the access permission verification request carries the client's identification and/or the user's identification; the communication unit 701 is also used to receive the first access permission sent from the distributed ledger node. Verification response, the first access permission verification response is used to indicate that the client has data access permission; the communication unit 701 is also used to send corresponding data to the client.
  • the communication unit 701 is also used to send a data return success message to the distributed ledger node, where the data return success message carries the client's data access transaction information.
  • the processing unit 702 when the processing unit 702 generates an access rights verification request based on a data access request, it is specifically configured to generate an access rights verification request based on a smart contract and a data access request.
  • the communication unit 701 is also used to receive a data update request sent from the client; the processing unit 702 is also used to generate an update authority verification request based on the data update request; the communication unit 701 is also used to Send an update authority verification request to the distributed ledger node.
  • the update authority verification request is used to verify whether the client has the authority to update data.
  • the update authority verification request carries the client's identity and/or the user's identity; the communication unit 701 is also used to receive
  • the first update authority verification response is sent from the distributed ledger node.
  • the first update authority verification response is used to indicate that the client has data update authority; the processing unit 702 is also used to update the data corresponding to the client.
  • each unit of the communication device shown in Figure 7 please refer to the relevant content about the data storage entity in the method embodiment corresponding to Figure 4 or Figure 6, and will not be described in detail here.
  • Each of the above units can be implemented in hardware, software, or a combination of software and hardware.
  • the communication unit 701 in the above content and the functions of the processing unit 702 may be implemented by one or more processors in the communication device.
  • the data access request sent from the client is received, and then the access permission verification request is sent to the distributed ledger node, so that the client no longer needs to request verification of access permission from the distributed ledger node, avoiding
  • a distributed ledger node receives access permission requests from a large number of clients, it can prevent the distributed ledger platform from being attacked by the network, which can improve the security of data access by clients.
  • Communication unit 701 configured to receive an access authority verification request sent from the data storage entity.
  • the access authority verification request is used to verify whether the client has the authority to access data.
  • the access authority verification request carries the client's identity and/or the user's identity;
  • process Unit 702 is used to verify whether the client has data access permissions based on the client's identity and/or the user's identity and the distributed ledger, which stores the data access policy of the client and/or the user; the communication unit 701 also If the client has data access rights, send a first access rights verification response to the data storage entity, and the first access rights verification response is used to indicate that the client has data access rights.
  • the communication unit 701 is also used for the distributed ledger node to receive a data return success message sent by the data storage entity.
  • the data return success message carries the client's data access transaction information; the processing unit 702 is also used for Record the client's data access transaction information in the distributed ledger.
  • the communication unit 701 is specifically used to: if the client has data access permissions and the distributed ledger node sends the first access permission verification response to the data storage entity: if the client has data access permissions , then the distributed ledger node generates a first access permission verification response based on the smart contract, and sends the first access permission verification response to the data storage entity.
  • the communication unit 701 is also configured to send a second access permission verification response to the data storage entity if the client does not have the data access permission.
  • the second access permission verification response is used to indicate that the client does not have the data access permission. Have data access rights.
  • the communication unit 701 is also used to receive an update authority verification request sent from the data storage entity.
  • the update authority verification request is used to verify whether the client has the authority to update data.
  • the update authority verification request carries the client The identity of the client and/or the identity of the user;
  • the processing unit 702 is also used to verify the identity of the client and/or the identity of the user and the distributed ledger to verify whether the client has the authority to update data, and the distributed ledger stores the client and/or user Data update policy;
  • the communication unit 701 is also used to send a first update authority verification response to the data storage entity if the client has data update authority, and the first update authority verification response is used to indicate that the client has data update authority.
  • each unit of the communication device shown in Figure 7 please refer to the relevant content related to the distributed ledger node in the method embodiment corresponding to Figure 4 or Figure 6, and will not be described in detail here.
  • Each of the above units can be implemented in hardware, software, or a combination of software and hardware.
  • the functions of the communication unit 701 and the processing unit 702 in the above content can be implemented by one or more processors in the communication device.
  • the communication device in this embodiment it is only necessary to receive access rights requests sent from the data storage entity, and there is no need to receive access rights requests sent from the client, thus avoiding the situation of receiving access rights requests sent from a large number of clients. Since the number of data storage entities is significantly reduced compared to clients and the security is higher, the security of data access by clients can be improved.
  • FIG 8 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • the communication device 80 can be used to implement the method described in the above method embodiment. For details, please refer to the description in the above method embodiment.
  • Communication device 80 may include one or more processors 801.
  • the processor 801 may be a general-purpose processor or a special-purpose processor, or the like.
  • the processor 801 can be used to control the communication device 80, execute software programs, and process data of the software programs.
  • the communication device 80 may include one or more memories 802, on which program code 803 may be stored, and the program code may be run on the processor 801, so that the communication device 80 executes the method described in the above method embodiment.
  • the memory 802 may also store data.
  • the processor 801 and the memory 802 can be provided separately or integrated together.
  • the memory 802 can also be located outside the communication device 80 and coupled with the communication device 80 in some ways.
  • the communication device 80 may also include a transceiver 804.
  • the transceiver 804 may be called a transceiver unit, a transceiver, a transceiver circuit, etc., and is used to implement transceiver functions.
  • the transceiver 804 may include a receiver and a transmitter.
  • the receiver may be called a receiver or a receiving circuit, etc., used to implement the receiving function;
  • the transmitter may be called a transmitter, a transmitting circuit, etc., used to implement the sending function.
  • Processor 801 configured to receive a data access request sent from the client; configured to generate an access rights verification request based on the data access request;
  • the processor 801 is also used to send an access authority verification request to the distributed ledger node.
  • the access authority verification request is used to verify whether the client has the authority to access data.
  • the access authority verification request carries the client's identity and/or the user's identity;
  • the processor 801 is also configured to receive a first access permission verification response sent from the distributed ledger node, where the first access permission verification response is used to indicate that the client has data access permission;
  • the processor 801 is also used to send corresponding data to the client.
  • the processor 801 is also configured to call the program code 803 from the memory 802 to perform the following operations: send a data return success message to the distributed ledger node, and the data return success message carries the client's data access transaction information.
  • the processor 801 when the processor 801 generates an access rights verification request based on a data access request, it is specifically configured to generate an access rights verification request based on a smart contract and a data access request.
  • the processor 801 is also configured to call the program code 803 from the memory 802 to perform the following operations: receive a data update request sent from the client; generate an update permission verification request based on the data update request; The ledger node sends an update permission verification request.
  • the update permission verification request is used to verify whether the client has the permission to update data.
  • the update permission verification request carries the client's identity and/or the user's identity; receives the first update sent from the distributed ledger node.
  • Permission verification response the first update authority verification response is used to indicate that the client has data update permission; update the client's corresponding data.
  • the operations performed by the communication device 80 may refer to the relevant content related to the data storage entity in the method embodiment corresponding to FIG. 4 or FIG. 6, which will not be described in detail here.
  • the communication device 80 receives the data access request sent from the client, and then sends the access permission verification request to the distributed ledger node, so that the client no longer needs to request the distributed ledger node to verify the access permission, and avoids distribution
  • a ledger node receives access permission requests from a large number of clients, it can Preventing distributed ledger platforms from being attacked by cyberattacks can improve the security of data access by clients.
  • Processor 801 configured to receive an access authority verification request sent from the data storage entity.
  • the access authority verification request is used to verify whether the client has the authority to access data.
  • the access authority verification request carries the client's identity and/or the user's identity;
  • the processor 801 is also used to verify whether the client has data access permissions based on the client's identity and/or the user's identity and the distributed ledger, which stores the data access policy of the client and/or the user;
  • the processor 801 is also configured to send a first access rights verification response to the data storage entity if the client has data access rights, where the first access rights verification response is used to indicate that the client has data access rights.
  • the processor 801 is also configured to call the program code 803 from the memory 802 to perform the following operations: after receiving the data return success message sent by the data storage entity, the data return success message carries the client's data access transaction information; Record the client's data access transaction information in the distributed ledger.
  • the processor 801 when the distributed ledger node sends a first access permission verification response to the data storage entity if the client has data access permission, the processor 801 is specifically used to: if the client has data access permission , then the distributed ledger node generates a first access permission verification response based on the smart contract, and sends the first access permission verification response to the data storage entity.
  • the processor 801 is also configured to call the program code 803 from the memory 802 to perform the following operations: if the client does not have the data access permission, send a second access permission verification response to the data storage entity.
  • the second access permission verification response is used to indicate that the client does not have data access permissions.
  • the processor 801 is also configured to call the program code 803 from the memory 802 to perform the following operations: receive an update permission verification request sent from the data storage entity, and the update permission verification request is used to verify whether the client has Permission to update data.
  • the update permission verification request carries the client's identity and/or the user's identity; verify whether the client has the authority to update data based on the client's identity and/or the user's identity and the distributed ledger.
  • the distributed ledger stores the customer Data update policy of the client and/or user; if the client has data update permission, then the first update permission verification response is sent to the data storage entity, and the first update permission verification response is used to indicate that the client has data update permission.
  • the operations performed by the communication device 80 may refer to the relevant content related to the distributed ledger node in the method embodiment corresponding to FIG. 4 or FIG. 6, which will not be described in detail here.
  • the communication device 80 only needs to receive access rights requests sent from the data storage entity, and does not need to receive access rights requests sent from clients, thus avoiding the situation of receiving access rights requests sent from a large number of clients, because The number of data storage entities is significantly reduced compared to clients, and the security is higher, which can improve the security of data access by clients.
  • the transceiver may be a transceiver circuit, an interface, or an interface circuit.
  • the transceiver circuits, interfaces or interface circuits used to implement the receiving and transmitting functions can be separate or integrated together.
  • the above-mentioned transceiver circuit, interface or interface circuit can be used for reading and writing codes/data, or the above-mentioned transceiver circuit, interface or interface circuit can be used for signal transmission or transfer.
  • the communication device 800 may include a circuit, and the circuit may implement the sending or receiving or communication functions in the foregoing method embodiments.
  • the processor and transceiver described in the embodiments of this application can be implemented in an integrated circuit Integrated circuit (IC), analog IC, radio frequency integrated circuit RFIC, mixed signal IC, application specific integrated circuit (ASIC), printed circuit board (PCB), electronic equipment, etc.
  • the communication device described in the above embodiments may be a terminal device or a network device, but the scope of the communication device described in the embodiments of the present application is not limited thereto, and the structure of the communication device may not be limited by FIG. 8 .
  • the communication device may be a stand-alone device or may be part of a larger device.
  • the communication device may be:
  • the IC collection may also include a storage component for storing data and instructions;
  • the communication device may be a chip or a chip system
  • the schematic structural diagram of the chip shown in FIG. 9 refer to the schematic structural diagram of the chip shown in FIG. 9 .
  • the chip shown in Figure 9 includes a processor 901 and an interface 902.
  • a memory 903 may also be included.
  • the number of processors 901 may be one or more, and the number of interfaces 902 may be multiple.
  • the interface 902 is used to receive or output signals
  • the processor 901 is used to perform data processing operations of the terminal device in the above method embodiment.
  • the interface 902 is used to receive or output signals
  • the processor 901 is configured to perform data processing operations of the network device in the above method embodiment.
  • the processor in the embodiment of the present application may be an integrated circuit chip with signal processing capabilities.
  • each step of the above method embodiment can be completed through an integrated logic circuit of hardware in the processor or instructions in the form of software.
  • the above-mentioned processor can be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (field programmable gate array, FPGA), or other available processors.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • programmed logic devices discrete gate or transistor logic devices, discrete hardware components.
  • the memory in the embodiment of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories.
  • the non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically removable memory. Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM), which is used as an external cache.
  • RAM random access memory
  • static RAM static Random access memory
  • dynamic RAM dynamic random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • This application also provides a computer-readable medium for storing computer software instructions. When the instructions are executed by a communication device, the functions of any of the above method embodiments are implemented.
  • This application also provides a computer program product for storing computer software instructions. When the instructions are executed by a communication device, the functions of any of the above method embodiments are implemented.
  • the above embodiments may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present application are generated in whole or in part.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another, e.g., the computer instructions may be transferred from a website, computer, server, or data center Transmission to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) means.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that contains one or more available media integrated.
  • the usable media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs (DVD)), or semiconductor media (e.g., solid state disks, SSD)) etc.
  • magnetic media e.g., floppy disks, hard disks, magnetic tapes
  • optical media e.g., high-density digital video discs (DVD)
  • DVD digital video discs
  • semiconductor media e.g., solid state disks, SSD
  • An embodiment of the present application also provides a computer program product.
  • the computer program product is run on a processor, the method flow of the above method embodiment is implemented.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)

Abstract

La présente demande divulgue un procédé, un système et un dispositif de gestion de données. Le procédé comprend les étapes suivantes : un client envoie une demande d'accès à des données à une entité de stockage de données ; l'entité de stockage de données envoie une demande de vérification d'autorisation d'accès à un nœud de registre distribué ; le nœud de registre distribué vérifie, sur la base de l'identifiant du client et/ou de l'identifiant d'un utilisateur dans la demande de vérification d'autorisation d'accès et d'un registre distribué, si le client dispose bien d'une autorisation d'accès aux données, le registre distribué stockant une politique d'accès aux données du client et/ou de l'utilisateur ; si le client dispose bien de l'autorisation d'accès aux données, le nœud de registre distribué envoie une première réponse de vérification d'autorisation d'accès à l'entité de stockage de données, la première réponse de vérification d'autorisation d'accès indiquant que le client dispose bien de l'autorisation d'accès aux données ; et, après réception de la première réponse de vérification d'autorisation d'accès envoyée par le nœud de registre distribué, l'entité de stockage de données envoie les données correspondantes au client. Sur la base du procédé, la sécurité de l'accès aux données par le client peut être améliorée.
PCT/CN2023/083514 2022-04-22 2023-03-23 Procédé, système et dispositif de gestion de données WO2023202321A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210429732.7A CN116980148A (zh) 2022-04-22 2022-04-22 一种数据管理的方法、系统及设备
CN202210429732.7 2022-04-22

Publications (1)

Publication Number Publication Date
WO2023202321A1 true WO2023202321A1 (fr) 2023-10-26

Family

ID=88419144

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/083514 WO2023202321A1 (fr) 2022-04-22 2023-03-23 Procédé, système et dispositif de gestion de données

Country Status (2)

Country Link
CN (1) CN116980148A (fr)
WO (1) WO2023202321A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109522735A (zh) * 2018-11-29 2019-03-26 上海中信信息发展股份有限公司 一种基于智能合约的数据权限验证方法及装置
US20210037060A1 (en) * 2019-08-02 2021-02-04 Dell Products L.P. System And Method For Distributed Network Access Control
CN112948842A (zh) * 2019-12-10 2021-06-11 华为技术有限公司 一种鉴权方法及相关设备
CN113610528A (zh) * 2021-08-24 2021-11-05 上海点融信息科技有限责任公司 基于区块链的管理系统、方法、设备及存储介质
CN113742782A (zh) * 2021-11-04 2021-12-03 中国信息通信研究院 基于隐私保护的区块链访问权限控制方法和区块链系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109522735A (zh) * 2018-11-29 2019-03-26 上海中信信息发展股份有限公司 一种基于智能合约的数据权限验证方法及装置
US20210037060A1 (en) * 2019-08-02 2021-02-04 Dell Products L.P. System And Method For Distributed Network Access Control
CN112948842A (zh) * 2019-12-10 2021-06-11 华为技术有限公司 一种鉴权方法及相关设备
WO2021115231A1 (fr) * 2019-12-10 2021-06-17 华为技术有限公司 Procédé d'authentification et dispositif associé
CN113610528A (zh) * 2021-08-24 2021-11-05 上海点融信息科技有限责任公司 基于区块链的管理系统、方法、设备及存储介质
CN113742782A (zh) * 2021-11-04 2021-12-03 中国信息通信研究院 基于隐私保护的区块链访问权限控制方法和区块链系统

Also Published As

Publication number Publication date
CN116980148A (zh) 2023-10-31

Similar Documents

Publication Publication Date Title
CN110915183B (zh) 经由硬/软令牌验证的区块链认证
WO2022083399A1 (fr) Procédé de traitement de données basées sur une chaîne de blocs, dispositif informatique, support d'enregistrement lisible par ordinateur et produit programme d'ordinateur
US11431702B2 (en) Authenticating and authorizing users with JWT and tokenization
TWI470989B (zh) 在應用及網際網路為基礎服務上提供信任單一登入存取方法及裝置
CN107579958B (zh) 数据管理方法、装置及系统
US11196561B2 (en) Authorized data sharing using smart contracts
US11829502B2 (en) Data sharing via distributed ledgers
CN111742531B (zh) 简档信息共享
WO2019196699A1 (fr) Procédé et dispositif permettant d'acquérir une politique de sécurité
CA2769842A1 (fr) Systeme et procede de gestion de droits a des donnees sur un reseau
CN112883406B (zh) 一种基于联盟链的远程医疗跨域认证方法
CN102223420A (zh) 一种面向多媒体社交网络的数字内容分发方法
US20090193520A1 (en) System and method for providing reputation reciprocity with anonymous identities
CN114143062A (zh) 基于区块链的雾计算环境的安全认证系统、方法、终端及介质
CN111597583B (zh) 一种基于区块链的数据共享交换方法
EP3834116A1 (fr) Système et procédé d'accès à un référentiel de données
CN104703183A (zh) 一种专线apn安全增强接入方法与装置
US20230370465A1 (en) Borrower privacy enhancement for shared-line solutions
WO2023202321A1 (fr) Procédé, système et dispositif de gestion de données
KR20210039190A (ko) 블록체인을 이용한 개인정보 관리 방법 및 그 방법이 적용된 블록체인 네트워크 관리자
US9071569B1 (en) System, method, and computer program for content metadata and authorization exchange between content providers and service providers
WO2021136511A1 (fr) Procédé et appareil de communication
US20200167771A1 (en) Object distribution processing
WO2016165443A1 (fr) Procédé de protection d'un dispositif de communication de type machine, entité de réseau et dispositif mtc
CN115438353A (zh) 一种用户数据管理方法以及相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23790981

Country of ref document: EP

Kind code of ref document: A1